4 ms·

Quad9 is reselling the traffic logs, so it means if you connect to secret hosts (like for your work), they will be leaked

by rvnx 1y ago

Demiurge 1y ago
Is this true? They claim that they don't keep any logs. Do you have a source?
- jeffbee 1y ago
  They don't claim that. Less than a week ago HN discussed their top resolved domains report. Such a report implies they have logs.
  - Demiurge 1y ago
    From their homepage: > How Quad9 protects your privacy? > When your devices use Quad9 normally, no data containing your IP address is ever logged in any Quad9 system. Of course they have some kinds of logs. Aggregating resolved domains without logging client IPs is not what the implication of "Quad9 is reselling the traffic logs" seems to be.
    - jeffbee 1y ago
      We're not discussing IP addresses, we are discussing whether their logs can leak your secret domain name.
      - Demiurge 1y ago
        Thats more clear, I get your point now. Again, though, that's not how most people would read the original comment. I've never even contemplated that I might generate some hostnames existence of which might be considered sensitive. It seems like a terrible idea to begin with, as I'm sure there are other avenues for those "secret" domains to be leaked. Perhaps name your secret VMs vm1, vm2, ..., instead of <your root password>. But yeah, this is not my area of expertise, nor a concern for the vast majority of internet users who want more privacy than their ISP will provide. I am curious though, do you have any suggestions for alternative DNS that is better?
        jeffbee 1y ago
        I use Google DNS because I feel it suits my personal theory of privacy threats. Among the various public DNS resolver services, I feel that they have the best technical defenses agains insider snooping and outside hackers infiltrating their systems, and I am unperturbed about their permanent logs. I also don't care about Quad9's logs, except to the extent that it seems inconsistent with the privacy story they are selling. I used Quad9 as my resolver of last resort in my config. I doubt any queries actually go there in practice.
daneel_w 1y ago
Could you show a citation? Your statement completely opposes Quad9's official information as published on quad9.net, and what's more it doesn't align at all with Bill Woodcock's known advocacy for privacy.
- gruez 1y ago
  See: https://quad9.net/privacy/policy/ https://quad9.net/privacy/policy/ It doesn't say they sell traffic logs outright, but they do send telemetry on blocked domains to the blocklist provider, and provides "a sparse statistical sampling of timestamped DNS responses" to "a very few carefully vetted security researchers". That's not exactly "selling traffic logs", but is fairly close. Moreover colloquially speaking, it's not uncommon to claim "google sells your data", even they don't provide dumps and only disclose aggregated data.
  - daneel_w 1y ago
    Disagree that it's fairly close to the statement "they resell traffic logs" and the implication that they leak all queried hostnames ("secret hosts, like for your work, will be leaked"). Unless Quad9 is deceiving users, both statements are, in fact, completely false. https://quad9.net/privacy/policy/#22-data-collected https://quad9.net/privacy/policy/#22-data-collected
    - gruez 1y ago
      >and the implication that they leak all queried hostnames ("secret hosts, like for your work, will be leaked"). The part about sharing data with "a very few carefully vetted security researchers" doesn't preclude them from leaking domains. For instance if the security researcher exports a "SELECT COUNT(*) GROUP BY hostname" query that would arguably count as "summary form", and would include any secret hostnames. >https://quad9.net/privacy/policy/#22-data-collected https://quad9.net/privacy/policy/#22-data-collected If you're trying to imply that they can't possibly be leaking hostnames because they don't collect hostnames, that's directly contradicted by the subsequent sections, which specifically mention that they share metrics grouped by hostname basis. Obviously they'll need to collect hostname to provide such information.
sophacles 1y ago
Im sorry... what is a secret hostname that is publicly resolvable? The very idea strikes me as irresponsible and misguided.
- notpushkin 1y ago
  It could be some subdomain that’s hard to guess. You can’t (generally) enumerate all subdomains through DNS, and if you use a wildcard TLS certificate (or self-signed / no cert at all), it won’t be leaked to CT logs either. Secret hostname.
  - rvnx 1y ago
    Examples: github.internal.companyname.com or jira.corp.org or jenkins-ci.internal-finance.acme-corp.com or grafana.monitoring.initech.io or confluence.prod.internal.companyx.com etc These, if you don't know the host, you will not be able to hit the backend service. But if you know, you can start exploiting it, either by lack of auth, or by trying to exploit the software itself
Quad9 1y ago
We are fully committed to end-user privacy. As a result, Quad9 is intentionally designed to be incapable of capturing end-users' PII. Our privacy policy is clear that queries are never associated with individual persons or IP addresses, and this policy is embedded in the technical (in)capabilities of our systems.
- rvnx 1y ago
  It is about the hostnames themselves like: git.nationalpolice.se but I understand that there is not much choice if you want to keep the service free to use so this is fair
  - staviette 1y ago
    Is that really a concern for most people? Trying to keep hostnames secret is a losing battle anyways these days. You should probably be using a trusted TLS certificate for your git hosting. And that means the host name will end up in certificate transparency logs which are even easier to scrape than DNS queries.
    - moontear 1y ago
      You would probably use wildcard certificates to NOT leak those subdomains

Quad9 is reselling the traffic logs, so it means if you connect to secret hosts (like for your work), they will be leaked

by rvnx 1y ago

Quad9 is reselling the traffic logs, so it means if you connect to secret hosts (like for your work), they will be leaked

Demiurge 1y ago

Is this true? They claim that they don't keep any logs. Do you have a source?

jeffbee 1y ago
They don't claim that. Less than a week ago HN discussed their top resolved domains report. Such a report implies they have logs.
- Demiurge 1y ago
  From their homepage: > How Quad9 protects your privacy? > When your devices use Quad9 normally, no data containing your IP address is ever logged in any Quad9 system. Of course they have some kinds of logs. Aggregating resolved domains without logging client IPs is not what the implication of "Quad9 is reselling the traffic logs" seems to be.
  - jeffbee 1y ago
    We're not discussing IP addresses, we are discussing whether their logs can leak your secret domain name.
    - Demiurge 1y ago
      Thats more clear, I get your point now. Again, though, that's not how most people would read the original comment. I've never even contemplated that I might generate some hostnames existence of which might be considered sensitive. It seems like a terrible idea to begin with, as I'm sure there are other avenues for those "secret" domains to be leaked. Perhaps name your secret VMs vm1, vm2, ..., instead of <your root password>. But yeah, this is not my area of expertise, nor a concern for the vast majority of internet users who want more privacy than their ISP will provide. I am curious though, do you have any suggestions for alternative DNS that is better?
      - jeffbee 1y ago
        I use Google DNS because I feel it suits my personal theory of privacy threats. Among the various public DNS resolver services, I feel that they have the best technical defenses agains insider snooping and outside hackers infiltrating their systems, and I am unperturbed about their permanent logs. I also don't care about Quad9's logs, except to the extent that it seems inconsistent with the privacy story they are selling. I used Quad9 as my resolver of last resort in my config. I doubt any queries actually go there in practice.

daneel_w 1y ago

Could you show a citation? Your statement completely opposes Quad9's official information as published on quad9.net, and what's more it doesn't align at all with Bill Woodcock's known advocacy for privacy.

gruez 1y ago
See: https://quad9.net/privacy/policy/ https://quad9.net/privacy/policy/ It doesn't say they sell traffic logs outright, but they do send telemetry on blocked domains to the blocklist provider, and provides "a sparse statistical sampling of timestamped DNS responses" to "a very few carefully vetted security researchers". That's not exactly "selling traffic logs", but is fairly close. Moreover colloquially speaking, it's not uncommon to claim "google sells your data", even they don't provide dumps and only disclose aggregated data.
- daneel_w 1y ago
  Disagree that it's fairly close to the statement "they resell traffic logs" and the implication that they leak all queried hostnames ("secret hosts, like for your work, will be leaked"). Unless Quad9 is deceiving users, both statements are, in fact, completely false. https://quad9.net/privacy/policy/#22-data-collected https://quad9.net/privacy/policy/#22-data-collected
  - gruez 1y ago
    >and the implication that they leak all queried hostnames ("secret hosts, like for your work, will be leaked"). The part about sharing data with "a very few carefully vetted security researchers" doesn't preclude them from leaking domains. For instance if the security researcher exports a "SELECT COUNT(*) GROUP BY hostname" query that would arguably count as "summary form", and would include any secret hostnames. >https://quad9.net/privacy/policy/#22-data-collected https://quad9.net/privacy/policy/#22-data-collected If you're trying to imply that they can't possibly be leaking hostnames because they don't collect hostnames, that's directly contradicted by the subsequent sections, which specifically mention that they share metrics grouped by hostname basis. Obviously they'll need to collect hostname to provide such information.

sophacles 1y ago

Im sorry... what is a secret hostname that is publicly resolvable? The very idea strikes me as irresponsible and misguided.

notpushkin 1y ago
It could be some subdomain that’s hard to guess. You can’t (generally) enumerate all subdomains through DNS, and if you use a wildcard TLS certificate (or self-signed / no cert at all), it won’t be leaked to CT logs either. Secret hostname.
- rvnx 1y ago
  Examples: github.internal.companyname.com or jira.corp.org or jenkins-ci.internal-finance.acme-corp.com or grafana.monitoring.initech.io or confluence.prod.internal.companyx.com etc These, if you don't know the host, you will not be able to hit the backend service. But if you know, you can start exploiting it, either by lack of auth, or by trying to exploit the software itself

Quad9 1y ago

We are fully committed to end-user privacy. As a result, Quad9 is intentionally designed to be incapable of capturing end-users' PII. Our privacy policy is clear that queries are never associated with individual persons or IP addresses, and this policy is embedded in the technical (in)capabilities of our systems.

rvnx 1y ago
It is about the hostnames themselves like: git.nationalpolice.se but I understand that there is not much choice if you want to keep the service free to use so this is fair
- staviette 1y ago
  Is that really a concern for most people? Trying to keep hostnames secret is a losing battle anyways these days. You should probably be using a trusted TLS certificate for your git hosting. And that means the host name will end up in certificate transparency logs which are even easier to scrape than DNS queries.
  - moontear 1y ago
    You would probably use wildcard certificates to NOT leak those subdomains